Skip to content

Commit 0493698

Browse files
mldangelo-oaimldangelo-oai
authored
fix: restore the SDK package and add Docker CI (#11)
* ci: validate customer bulk-scan containers * fix: include missing customer container and package assets * fix: use supported Linux sandbox in customer container * fix: harden customer scan entrypoint and Git credentials * fix: default container to supported Linux sandbox * fix: apply the approved Dockerfile ignore baseline * fix: preserve scan flags and enterprise Git credentials * fix: normalize default HTTPS credential ports * fix: use the verified canonical Docker ignore file * fix: normalize mixed-case SCP repository hosts * fix: harden customer container CI checks * fix: preserve sandbox fallback and candidate paths * fix: exclude dotenv variants from container builds
1 parent 963bdda commit 0493698

5 files changed

Lines changed: 604 additions & 134 deletions

File tree

‎.github/workflows/container-ci.yml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: container-ci
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- .dockerignore
8+
- .github/workflows/container-ci.yml
9+
- Dockerfile
10+
- Dockerfile.dockerignore
11+
- compose.yaml
12+
- docker/**
13+
- sdk/typescript/**
14+
pull_request:
15+
paths:
16+
- .dockerignore
17+
- .github/workflows/container-ci.yml
18+
- Dockerfile
19+
- Dockerfile.dockerignore
20+
- compose.yaml
21+
- docker/**
22+
- sdk/typescript/**
23+
workflow_dispatch:
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
container:
30+
name: linux-amd64
31+
runs-on: ubuntu-latest
32+
timeout-minutes: 30
33+
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37+
with:
38+
persist-credentials: false
39+
40+
- name: Verify customer build excludes secrets and scan data
41+
shell: bash
42+
run: |
43+
set -euo pipefail
44+
ignore_file=.dockerignore
45+
if [[ -f Dockerfile.dockerignore ]]; then
46+
ignore_file=Dockerfile.dockerignore
47+
if ! cmp -s .dockerignore "$ignore_file"; then
48+
echo "Dockerfile-specific ignore rules must match the approved customer baseline." >&2
49+
exit 1
50+
fi
51+
fi
52+
53+
if grep -Fq '!' "$ignore_file"; then
54+
echo "Customer Docker ignore rules must not re-include excluded files: $ignore_file" >&2
55+
exit 1
56+
fi
57+
58+
for pattern in \
59+
'**/.env' \
60+
'**/.env.*' \
61+
'**/.npmrc' \
62+
'**/node_modules' \
63+
'**/*.csv' \
64+
'**/repositories.csv' \
65+
'**/results' \
66+
'**/security-scans' \
67+
'**/state'; do
68+
if ! grep -Fxq -- "$pattern" "$ignore_file"; then
69+
echo "Missing customer Docker build exclusion in $ignore_file: $pattern" >&2
70+
exit 1
71+
fi
72+
done
73+
74+
- name: Set up Docker Buildx
75+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
76+
77+
- name: Build customer container
78+
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
79+
with:
80+
context: .
81+
load: true
82+
platforms: linux/amd64
83+
push: false
84+
tags: codex-security:ci
85+
86+
- name: Verify bundled scanner
87+
run: |
88+
docker run --rm codex-security:ci --version
89+
docker run --rm codex-security:ci bulk-scan --help
90+
docker run --rm codex-security:ci info --json
91+
92+
- name: Validate hardened customer Compose configuration
93+
env:
94+
CODEX_SECURITY_IMAGE: codex-security:ci
95+
run: |
96+
mkdir -p results state
97+
chmod 700 results state
98+
printf 'id,repository,revision\n' > repositories.csv
99+
export CODEX_SECURITY_USER="$(id -u):$(id -g)"
100+
docker compose config --quiet
101+
docker compose run --rm codex-security --version
102+
103+
- name: Verify hardened Codex command sandbox
104+
shell: bash
105+
run: |
106+
set -euo pipefail
107+
command=(
108+
docker run --rm
109+
--cap-drop ALL
110+
--security-opt no-new-privileges
111+
--security-opt "seccomp=$GITHUB_WORKSPACE/docker/codex-security-seccomp.json"
112+
--entrypoint node
113+
codex-security:ci
114+
/usr/local/lib/node_modules/@openai/codex-security/node_modules/@openai/codex/bin/codex.js
115+
)
116+
117+
if output="$("${command[@]}" sandbox /usr/bin/true 2>&1)"; then
118+
printf '%s\n' "$output"
119+
elif grep -Eq 'bwrap: (Failed to make / slave: Permission denied|loopback: Failed RTM_NEW(ADDR|LINK): Operation not permitted|setting up uid map: Permission denied|No permissions to create a new namespace)' <<< "$output"; then
120+
echo '::warning::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.'
121+
"${command[@]}" sandbox --enable use_legacy_landlock /usr/bin/true
122+
else
123+
printf 'The hardened Codex sandbox failed unexpectedly:\n%s\n' "$output" >&2
124+
exit 1
125+
fi
126+
127+
- name: Reject interactive repository discovery
128+
shell: bash
129+
run: |
130+
set -euo pipefail
131+
if output="$(docker run --rm -t codex-security:ci bulk-scan 2>&1)"; then
132+
echo "The customer container must require a repository CSV." >&2
133+
exit 1
134+
else
135+
status=$?
136+
fi
137+
if [[ "$status" -ne 2 ]]; then
138+
printf 'The customer container returned unexpected exit status %s:\n%s\n' "$status" "$output" >&2
139+
exit 1
140+
fi
141+
expected='codex-security: bulk-scan requires a repository CSV; interactive discovery is not supported in this image.'
142+
if [[ "${output//$'\r'/}" != "$expected" ]]; then
143+
printf 'The customer container returned an unexpected repository discovery error:\n%s\n' "$output" >&2
144+
exit 1
145+
fi
146+
147+
- name: Verify host-scoped noninteractive Git credentials
148+
shell: bash
149+
run: |
150+
set -euo pipefail
151+
docker run --rm \
152+
--entrypoint /bin/sh \
153+
--env GH_TOKEN=SYNTHETIC_GITHUB_TOKEN \
154+
codex-security:ci \
155+
-ec 'actual="$(printf "protocol=https\nhost=github.com\n\n" | /usr/local/bin/codex-security-git-credential get)"; test "$actual" = "$(printf "username=x-access-token\npassword=SYNTHETIC_GITHUB_TOKEN")"; test -z "$(printf "protocol=https\nhost=untrusted.example\n\n" | /usr/local/bin/codex-security-git-credential get)"'

0 commit comments

Comments
 (0)